[SPAM] Re: [SPAM] Certain spams not recognized by SP
Anthony Campbell <ac-MeA/[email protected]> Fri, 12 Dec 2008 08:46:29 +0000
| Newsgroups | gmane.mail.spam.spamprobe.general,gmane.spam.detected |
|---|---|
| Message-ID | <[email protected]> |
On 12 Dec 2008, Thomas Sch=FCrger wrote: > Hi, > = > lately, I get a lot of HTML spams containing the subject "Delivery = > Status Notification (Failure)" > and the following body (with a lot of different target URLs for link and = > image): > = > --- > = > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> > <HTML><HEAD> > <META http-equiv=3DContent-Type content=3D"text/html; charset=3Diso-8859-= 1"> > </HEAD> > <BODY><a href=3D"http://motivationsection.com/" target=3D"_blank"> > <img src=3D"http://motivationsection.com/adv4.jpg" border=3D0 alt=3D"Havi= ng = > trouble viewing this email? > Click here to view as a webpage."></a></BODY></HTML> > = > --- > = > All of these spams have the same text in the "alt" attribute and so = > should be easily recognizable, > but with the standard scanning mechanism, this is not tokenized by = > SpamProbe. The headers of > these mails also look innocent. Therefore, SpamProbe treats these mails = > as hams. > = > Are there any ways of improving this with the standard scanning = > mechanism? I've seen that > using "-o graham" would improve recognizing these kinds of spams, = > because all HTML stuff is > tokenized, but I already have large databases with standard scanning and = > switching the mode > now wouldn't be the best, I guess. > = > = > Regards, > Thomas. > = I've had the same problem. They have been getting past spamprobe and qsf (I run both).As a workaround I put an entry in procmail to filter out anything with "* Click" in the body. This catches most of them (plus a few innocent emails) and then I train spamprobe (and qsf) on those. Gradually morre of them seem to being caught. Anthony -- = Anthony Campbell - ac-MeA/[email protected] = Microsoft-free zone - Using Debian GNU/Linux http://www.acampbell.org.uk (blog, book reviews, = and sceptical articles) ---------------------------------------------------------------------------= --- SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas, Nevada. The future of the web can't happen without you. Join us at MIX09 to help pave the way to the Next Web now. Learn more and register at http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/